Buggy code:
public final class Mp4Util { public static final int ATOM_HEADER_SIZE = 8 ; public static final int LONG_ATOM_HEADER_SIZE = 16 ; public static final int FULL_ATOM_HEADER_SIZE = 12 ; public static final int LONG_ATOM_SIZE = 1 ; public static final int NO_SAMPLE = - 1 ; public static final int NO_TRACK = - 1 ; private static final byte [ ] NAL_START_CODE = new byte [ ] { 0 , 0 , 0 , 1 } ; public static int parseFullAtomVersion ( int fullAtomInt ) { } public static int parseFullAtomFlags ( int fullAtomInt ) { } public static int readUnsignedIntToInt ( ByteBuffer data ) { } public static void replaceLengthPrefixesWithAvcStartCodes ( ByteBuffer buffer , int size ) { } public static byte [ ] parseChildNalUnit ( ParsableByteArray atom ) { } public static int findNalUnit ( byte [ ] data , int startOffset , int endOffset , int type ) { } public static int findNalUnit ( byte [ ] data , int startOffset , int endOffset , int type , boolean [ ] prefixFlags ) { int length = endOffset - startOffset ; Assertions . checkState ( ( length >= 0 ) ) ; if ( length == 0 ) { return endOffset ; } if ( prefixFlags != null ) { if ( ( prefixFlags [ 0 ] ) && ( Mp4Util . matchesType ( data , startOffset , type ) ) ) { Mp4Util . clearPrefixFlags ( prefixFlags ) ; return startOffset - 3 ; } else if ( ( ( ( length > 1 ) && ( prefixFlags [ 1 ] ) ) && ( ( data [ startOffset ] ) == 1 ) ) && ( Mp4Util . matchesType ( data , ( startOffset + 1 ) , type ) ) ) { Mp4Util . clearPrefixFlags ( prefixFlags ) ; return startOffset - 2 ; } else if ( ( ( ( ( length > 2 ) && ( prefixFlags [ 2 ] ) ) && ( ( data [ startOffset ] ) == 0 ) ) && ( ( data [ ( startOffset + 1 ) ] ) == 1 ) ) && ( Mp4Util . matchesType ( data , ( startOffset + 2 ) , type ) ) ) { Mp4Util . clearPrefixFlags ( prefixFlags ) ; return startOffset - 1 ; } } <START_BUG> int limit = endOffset - 2 ; <END_BUG> for ( int i = startOffset + 2 ; i < limit ; i += 3 ) { if ( ( ( data [ i ] ) & 254 ) != 0 ) { } else if ( ( ( ( ( data [ ( i - 2 ) ] ) == 0 ) && ( ( data [ ( i - 1 ) ] ) == 0 ) ) && ( ( data [ i ] ) == 1 ) ) && ( Mp4Util . matchesType ( data , ( i + 1 ) , type ) ) ) { return i - 2 ; } else { i -= 2 ; } } if ( prefixFlags != null ) { prefixFlags [ 0 ] = ( length > 2 ) ? ( ( ( data [ ( endOffset - 3 ) ] ) == 0 ) && ( ( data [ ( endOffset - 2 ) ] ) == 0 ) ) && ( ( data [ ( endOffset - 1 ) ] ) == 1 ) : length == 2 ? ( ( prefixFlags [ 2 ] ) && ( ( data [ ( endOffset - 2 ) ] ) == 0 ) ) && ( ( data [ ( endOffset - 1 ) ] ) == 1 ) : ( prefixFlags [ 1 ] ) && ( ( data [ ( endOffset - 1 ) ] ) == 1 ) ; prefixFlags [ 1 ] = ( length > 1 ) ? ( ( data [ ( endOffset - 2 ) ] ) == 0 ) && ( ( data [ ( endOffset - 1 ) ] ) == 0 ) : ( prefixFlags [ 2 ] ) && ( ( data [ ( endOffset - 1 ) ] ) == 0 ) ; prefixFlags [ 2 ] = ( data [ ( endOffset - 1 ) ] ) == 0 ; } return endOffset ; } public static int findNalUnit ( byte [ ] data , int startOffset , int endOffset ) { } public static int findNalUnit ( byte [ ] data , int startOffset , int endOffset , boolean [ ] prefixFlags ) { } public static int getNalUnitType ( byte [ ] data , int offset ) { } private static void clearPrefixFlags ( boolean [ ] prefixFlags ) { } private static boolean matchesType ( byte [ ] data , int offset , int type ) { } }

Fix:
int limit = endOffset - 1 ;